81778a2c2d
The API key is no longer sent as plaintext in HTTP responses. Instead, the frontend performs a reveal handshake: fetches the server's RSA public key, generates a session AES-256 key, RSA-OAEP wraps it, and the server returns the API key encrypted with AES-GCM. This protects the bearer token even when Studio is served over plain HTTP. |
||
|---|---|---|
| .. | ||
| single-env | ||
| __init__.py | ||
| base.txt | ||
| extras-no-deps.txt | ||
| extras.txt | ||
| no-torch-runtime.txt | ||
| overrides.txt | ||
| studio.txt | ||
| triton-kernels.txt | ||